SQL Injection Vulnerability in Joomla Extension SP Page Builder by JoomShaper
CVE-2026-65877

8.2HIGH

Key Information:

Vendor

Joomshaper.com

Status
Sp Page Builder Extension For Joomla
Vendor
CVE Published:
27 July 2026

What is CVE-2026-65877?

An authenticated SQL injection vulnerability exists in the SP Page Builder extension for Joomla, specifically in versions prior to 6.7.1. This vulnerability arises from improper validation of parameters in the media manager's search and date filters, enabling attackers to manipulate SQL queries. If exploited, this can lead to unauthorized access and exposure of sensitive data within the application's database.

Affected Version(s)

SP Page Builder extension for Joomla 1.0.0-6.7.0

References

https://www.joomshaper.com/page-builder
product
https://mysites.guru/blog/sp-page-builder-sql-injection-m...
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phil Taylor
.